Splunk Search

Lookup table help

tkerr357
Observer

Hello all,

Looking for some help integrating a lookup table into my failed login search. What I am trying to achieve is to look for any events matching the base search I have below using each of the account name variations in the table. Any help is much appreciated. 

base search: index=wineventlog OR index=h_wineventlog EventCode=4625 user=(LL,CL,TL would go here) | stats count by user

example of table below : 

tkerr357_0-1593623557125.png

 

Labels (1)
0 Karma

chrisboy68
Contributor

Look a inputlookup https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Inputlookup

You will want to match with your base search and perform logic on the fields returned from the lookup and base.

 

HTH

 

Chris

0 Karma

tkerr357
Observer

sorry I have read through the documentation but can you provide a brief example of what you mean? 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...